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Audit 
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May 14, 2014 

Thomas J. Curry 
Comptroller of the Currency 

This report presents the results of our audit of the Office of the 
Comptroller of the Currency's (OCC) supervision of bank trading 
activities. This audit was prompted by the media attention and 
congressional hearings focused on the 2012 trading losses at the 
JPMorgan Chase Bank, N.A. (JPMC) Chief Investment Office (CIO) 
in London. 

Our audit objective was to determine and assess OCC's process of 
supervising bank trading activities, primarily focusing on OCC's 
supervision of trading activities at the JPMC CIO. We interviewed 
OCC personnel involved in supervising these activities and 
reviewed relevant OCC documentation during audit fieldwork 
conducted from July 2012 through January 2013. Appendix 1 
contains a more detailed description of our objectives, scope, and 
methodology. 

Results in Brief 

We found that OCC had many opportunities to address 
weaknesses in the ClO's risk management of trading activities, but 
did not act strongly or timely enough to address those weaknesses. 
In some cases, OCC failed to act at all. Specifically, OCC did not 
(1) follow up on a 2010 matter requiring attention (MRA) 1 
regarding the ClO's lack of risk management policies, (2) follow up 



1 An MRA is a bank practice identified during an examination that deviates from sound governance, 
internal control, and risk management principles, which may adversely affect the bank's earnings or 
capital, risk profile, or reputation if not addressed. It may also result in substantive noncompliance 
with laws and regulations, internal policies or processes, OCC supervisory guidance, or conditions 
imposed in writing in connection with the approval of any application or other request by a bank. In 
some circumstances, a matter requiring attention could also be an unsafe or unsound practice. 
OCC's expectation is that bank management will act upon the MRA. 
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on concerns it had with the CIO internal audit function; and 
(3) appropriately address signs of increasing risk in the Synthetic 
Credit Portfolio (SCP). 2 We believe that a stronger, timelier OCC 
response to these weaknesses may have limited the losses. 

Further, we determined that (1) the Comptroller's Handbook lacked 
comprehensive guidance on supervision of bank trading activities 
and (2) OCC's coordination of its dual supervision responsibilities 
with the Board of Governors of the Federal Reserve System (FRB) 
needs improvement. We also include one matter regarding OCC's 
London office. 

We recommend that OCC take the following actions: 

1 . Ensure that examiners review bank reports and obtain 
satisfactory explanations when those reports show 
significant signs of increasing risk in trading activities. 

2. Amend OCC policies and procedures to clarify that 
examiners should follow up on MRAs no later than during 
the next supervisory cycle, or sooner as dictated by the 
urgency of the examination finding. 

3. Ensure that examiners follow up on findings or concerns 
with a bank's internal audit office and expand the review of 
the internal audit function, as necessary, to determine its 
effectiveness. 

4. Improve supervisory coordination with other regulatory 
agencies and consider formalizing any understanding or 
agreement. 

5. Ensure that revisions to the Handbook for supervision of 
trading activities communicate to examiners all activities 
required to be performed during both ongoing supervision 
and targeted examinations. 



The SCP was a portfolio of credit derivatives that grew to have a large and complex set of risks. 
Credit derivatives are financial contracts designed to hedge credit-risk exposure by providing 
insurance against losses suffered through credit events, such as downgrade by a rating agency 
below a specified minimum level, bankruptcy or insolvency by the obligor, or default on payment 
obligations. 
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Management Response In a written response, included as 
appendix 2, OCC stated that it undertook a two-pronged review of 
its supervisory activities in response to the events at JPMC. The 
first prong focused on an informed evaluation of the adequacy of 
current risk controls at the bank. OCC assessed the quality of 
management and risk management; board oversight; the types and 
reasonableness of risk measurement metrics and limits; the model 
governance review process; and the quality of work by the 
independent risk management team and internal auditors. OCC also 
assessed the adequacy of the information and reporting provided to 
bank management and to OCC. This review resulted in the OCC 
entering into a consent order with JPMC to correct unsafe and 
unsound practices and violations of law or regulation related to 
derivatives trading activities conducted on behalf of the bank by 
the CIO. The OCC also assessed a $300 million civil money 
penalty. 

The second prong addresses trading activities more broadly and 
draws on the lessons learned from this event that could enhance 
risk management processes at other banks. Consistent with 
supervisory policy of heightened expectations for large banks, OCC 
is demanding that banks adhere to the highest risk management 
standards. OCC is also assessing the adequacy of risk management 
throughout the bank. If corrective action is warranted, OCC will 
pursue appropriate informal or formal remedial measures. 
Additionally, OCC is identifying ways to improve its supervision. 

OCC also stated that it has issued procedures 3 that supplement the 
Comptroller's Handbook for end-user derivatives and trading 
activities that address many of our recommendations. These 
supplemental procedures include scope-setting and ongoing 
monitoring procedures. As part of its roll-out of the supplemental 
procedures, OCC stated it will issue a supervisory memo to all 
examiners that communicates its expectations about their use. In 
regard to the recommendation to improve supervisory coordination 
with other regulatory agencies, OCC stated it has instituted a 
number of actions including making interagency coordination a 



3 Auditor's Note: The procedures referenced in the response were issued as an attachment to OCC 
Bulletin 2014-8 titled End-User Derivatives and Trading Activities: Supplemental Examination 
Procedures (Mar. 24, 2014). 
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priority and working with FRB and the Federal Deposit Insurance 
Corporation (FDIC) to coordinate supervisory strategies in large 
bank supervision. OCC also stated in some cases, it has entered 
into memoranda of understanding with other agencies to formalize 
the understandings for sharing information and coordinating 
supervision. 

OIG Comment We consider the actions taken and planned by OCC 
as responsive to our recommendations. 

Background 

Bank trading activities are defined as the buying or selling of 
securities, financial instruments, or commodities on behalf of 
customers or the bank's own account. Trading account assets 
owned by the bank are segregated from the bank's investment 
portfolio, which includes trading account assets managed on behalf 
of customers. 

OCC's capital-markets teams are responsible for the supervision of 
bank trading activities at JPMC and other large banks. 4 The teams 
conduct both ongoing supervision and targeted examinations. 
Ongoing supervision includes regular monitoring of the bank's 
trading activities to assess risk and management's control of that 
risk. The size of the teams varies. Some examiners on capital- 
market teams have prior trading experience at large banks. 

OCC conducts targeted examinations on specific trading desks or 
areas perceived to have the highest level of risk. During targeted 
examinations, OCC examiners perform walk-throughs of bank 
trading activities, testing of data integrity, valuation, and risk 
management; and meet with bank traders, risk managers, internal 
audit personnel, and other senior management. Each examination 
results in a report or supervisory letter that may include findings on 
risk, violations of laws or regulations, MRAs, and 
recommendations. Typically, the capital-markets teams complete 
four to six targeted examinations per year. 



4 Large banks include the largest national banking companies that generally are involved in the most 
complex activities and operate over wide geographic areas. 
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JPMC performs a number of trading activities, including debt and 
equity underwriting; market making and trading of fixed income 
and equity investments, derivatives, and commodities; corporate 
lending; and principal investing. The CIO is a management unit of 
the JPMC Bank Holding Company used to manage JPMC's 
exposure to various risks and to invest cash for JPMC. The SCP 
was used to provide protection to JPMC from credit risk. The CIO 
did not trade on behalf of bank customers. 

Beginning in January 2012, the SCP experienced large losses. In 
trying to counteract the losses, the CIO executed a flawed strategy 
to reduce exposures by doubling the size of the positions in the 
SCP twice, quickly and dramatically increasing the size of the 
portfolio. This strategy failed, resulting in losses of approximately 
$6 billion. 

As of the date of this report, various agencies, including the 
Treasury Inspector General's Office of Investigations, had open 
cases related to JPMC and its trading activities. In addition, the 
U.S. Senate Permanent Subcommittee on Investigations conducted 
an investigation and issued its final report on the CIO trading losses 
in March 201 3. 5 

Findings 

OCC's Supervisory Response to the Chief Investment 
Office's Poor Risk Management and Increasing Risk in the 
Synthetic Credit Portfolio Was Insufficient 

OCC had many opportunities to respond to JPMC ClO's poor risk 
management and escalating risk in the SCP, but did not act 
strongly or timely enough to address its concerns and, in some 
instances, failed to act at all. As early as 2010, OCC examiners 
identified deficiencies in the ClO's risk management policies and 
internal audit function. However, the examiners did not follow up 
to ensure that the CIO corrected the problems. Further, examiners 
did not seek explanations for the significant and unprecedented 
SCP gains in 201 1 and losses in early 2012. This sequence of 



U.S. Senate Permanent Subcommittee on Investigations, "JPMorgan Chase Whale Trades: A Case 
History of Derivatives Risks and Abuses," Mar. 15, 2013. 
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events shows a breakdown in risk management, controls, and 
supervision. 

A more in-depth discussion of the identified deficiencies and OCC's 
response follows. 

Lack of Risk Management Policies in CIO 

OCC's Large Bank Supervision booklet states that, as an 
organization grows more diverse and complex, the sophistication of 
its risk management must keep pace. Further, it calls for banks to 
establish and communicate risk limits through policies, standards, 
and procedures that define responsibility and authority, specifying 
that these limits should serve as a means to control exposures to 
the various risks associated with the bank's activities. OCC's 
Policies & Procedures Manual (OCC PPM 5310-3) states that bank 
corrective action should deal with weaknesses at an early stage, 
before they can develop into more serious problems. Corrective 
action may involve securing management and board commitments 
to undertake specific remedial measures to address OCC's 
concerns. It also states that once a bank has begun taking proper 
actions to correct problems and prevent further deterioration, OCC 
will follow up to ensure the success of such measures. 

In July 2010, OCC conducted an examination of the ClO's 
investment portfolios. [REDACTED - FOIA EXEMPTION 8, 5 U.S.C. 
§552(b)(8)] 
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Because OCC did not address ClO's unsatisfactory response to the 
MRA and did not follow up on compliance with the MRA, it did not 
learn that risk management in the CIO continued to remain weak, 
with very little oversight. This weak risk management allowed SCP 
exposures to grow to an unmanageable level, which led to the $6 
billion trading loss. 

OCC officials told us that the standard operating procedure used by 
examiners to address MRAs during large bank supervision will be 
revised to improve the tracking, documentation, and timeliness of 
follow-up actions. 

Weak Internal Audit Function at CIO 

OCC's Large Bank Supervision booklet states that examiners 
should evaluate and validate the bank's internal audit function as 
part of the core assessment 6 to determine, based on a review of 
the core assessment factors, whether it is strong, satisfactory, or 
weak. Examiners may identify significant auditor control 
discrepancies or weaknesses, or may raise questions about the 
audit function's effectiveness after completing the core 
assessment. In those situations, examiners should consider 
expanding the scope of the review of internal audit. 

[REDACTED - FOIA EXEMPTION 8, 5 U.S.C. §552(b)(8)] 



The supervisory framework for large banks includes a core assessment, which provides the 
standards and procedures for OCC examiners to use to meet the requirements of a full-scope, on-site 
examination. Examiners use the core assessment and the risk assessment system (RAS) to measure 
and assess existing and emerging risks in large banks. This risk assessment drives supervisory 
strategies and activities. 
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OCC did not address these internal audit weaknesses in the CIO by 
expanding the scope of its review of internal audit or issuing an 
MRA. Examiners told us they were planning to review the CIO 
internal audit function again during the next supervisory cycle in 
2012. We believe OCC's insufficient supervisory response to ClO's 
internal audit office contributed to a weak risk management 
function continuing in the CIO. If internal audit in the CIO had been 
stronger, issues with the SCP trading desk may have been 
highlighted earlier, and adequate risk management policies and 
procedures may have been put in place. 

Increasing Risk in SCP 

In addition to evidence of poor risk management in the CIO prior to 
the 2012 trading losses, OCC examiners had access to bank 
reports that showed evidence of increasing risk in the SCP. 

[REDACTED - FOIA EXEMPTION 8, 5 U.S.C. §552(b)(8)] 

7 



8 



9 



7 [REDACTED - FOIA EXEMPTION 8, 5 U.S.C. §552(b)(8)] 

8 [REDACTED - FOIA EXEMPTION 8, 5 U.S.C. §552(b)(8)] 

9 [REDACTED - FOIA EXEMPTION 8, 5 U.S.C. §552(b)(8)] 
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10 1 1 



10 [REDACTED - FOIA EXEMPTION 8, 5 U.S.C. §552(b)(8)] 

11 [REDACTED - FOIA EXEMPTION 8, 5 U.S.C. §552(b)(8)] 
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[REDACTED - FOIA EXEMPTION 8, 5 U.S.C. §552(b)(8)] 



In 

addition, in January 2013, OCC issued a cease and desist order 
(C&D order) to JPMC. The C&D order required JPMC, among other 
things, to submit an acceptable written plan to ensure that the 
board of directors has appropriate oversight and governance of the 
SCP trading. 

We believe that OCC took appropriate action after the SCP trading 
losses became public, but it should have acted stronger and 
timelier to address ClO's poor risk management and the increasing 
risk in the SCP prior to May 2012. For example, evidence of a 
weak internal audit function should have warranted more scrutiny 
and an MRA, if necessary. Multiple instances of management 
approval of limit excessions should have also raised doubt about 
the quality of the ClO's risk management function. However, OCC 
did not sufficiently address these deficiencies, which contributed to 
the buildup of SCP positions that led to significant trading losses. 

OCC conducted an internal review of its supervision of the CIO and 
of the JPMC losses, reporting its findings in October 2012. We 
reviewed the OCC report, which is not publicly available. OCC's 
findings are consistent with our conclusions. The OCC report noted 
that (1) OCC did not recognize the extent of SCP risk and its 
potential for such large losses, despite opportunities to become 
aware of the risk through JPMC reporting available to examiners; 
and (2) OCC examiners could have followed up more diligently with 
regard to the 2010 CIO MRA and 2012 VaR model discussed 
above. We note that the OCC report concluded that the CIO 
management was not forthcoming to OCC examiners about its SCP 
strategy. While the report did not include recommendations, it did 
include lessons learned that stated, among other things, examiners 
should (1) review desk level risk and performance reports to check 
that executive and corporate level reporting does a good job of 
summarizing important information, and to evaluate the adequacy 
of that reporting; (2) investigate outsized gains similar to the SCP 
windfall gain in November 201 1; and (3) assign target dates for 
closing MRAs and follow up on MRAs with deadlines. 



OCC Needs to Strengthen Supervision of Trading Activities in Light of Page 10 

the JPMorgan Chase Trading Losses (OIG- 14-035) 



OCC Should Improve Coordination of Its Dual Regulatory 
Responsibilities with FRB 

In accordance with 12 CFR 21 1, a depository institution may 
organize or acquire a separate subsidiary to engage in international 
banking activities as an Edge Act corporation (Edge entity). 
Congress authorized banks to establish subsidiaries under the Edge 
Act principally to encourage foreign trade and to permit banks to 
engage in activities that are not permissible under U.S. banking 
regulations. Under federal law, FRB licenses and regulates JPMC's 
holding company and Edge entities. OCC regulates JPMC's national 
bank. 

OCC's Large Bank Supervision booklet states that effective 
planning for all large companies requires adequate and timely 
communication among supervisory agencies, including functional 
regulators. The regulatory authority over the activities carried out 
by the CIO is divided and overlapping. This is because the CIO is a 
management unit of the holding company with its holdings booked 
in various legal entities including the national bank and Edge 
entities. The trading activities that caused the losses in the SCP 
were originally booked in the national bank. At the end of each 
month, the bank transferred these positions from its books to the 
books of a subsidiary of an Edge entity, which is regulated by FRB. 
According to OCC examiners, this is a common practice, intended 
to transfer risk from the national bank to the Edge entity. OCC 
examiners stated that they did not know FRB's requirements for 
supervising Edge activities, or whether FRB reviewed these month- 
end accounting transactions. 

Opportunities exist for improved communication and coordination 
between OCC and FRB regarding supervisory activities. Dual 
supervision without proper coordination and communication may 
lead to lapses in supervision or duplication of supervisory efforts. 
An OCC official told us that the Comptroller has undertaken an 
initiative to improve coordination with other agencies, and JPMC is 
part of the pilot effort. 
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The Comptroller's Handbook Lacks Comprehensive 
Examiner Guidance for Supervision of Trading Activities 

The Comptroller's Handbook states that it contains the most 
current concepts and procedures for the examination of national 
banks, and is designed to provide examiners and their managers 
with the information necessary to plan and coordinate an 
examination, monitor problems or other conditions, and implement 
appropriate follow up. 

As described in the background section of this report, OCC capital- 
markets teams perform both ongoing supervision and targeted 
examinations of bank trading activities. We noted that the 
handbook has procedures for examiners to follow during targeted 
examinations of specific trading activities, such as derivatives, but 
it does not provide comprehensive examiner guidance for ongoing 
supervision or for targeted examinations of trading activities. When 
asked, OCC examiners said they rely on judgment rather than a set 
of procedures or checklists when supervising bank trading 
activities. 

Given the amount of risk and complexity surrounding bank trading 
activities, we believe it is important that OCC provide examiners 
both guidance and expectations regarding the supervision of those 
trading activities. Using judgment alone in determining how to 
supervise trading activities may result in underestimating the level 
of risk within a bank's line of business or specific trading desk. 

According to an OCC official, the Chief National Bank Examiner's 
office is revising the Comptroller's Handbook to clarify 
expectations regarding identifying and reporting on significant 
investment portfolios and trading-book exposures. 

Other Matter 

OCC has a team of five examiners in London that assist with 
targeted examinations at several large banks with foreign offices. 
In addition to JPMC, OCC supervises five other U.S. banks with 
operations in London: Bank of America, N.A.; Citibank, N.A.; Wells 
Fargo Bank, N.A.; Capital One Bank, N.A.; and BlackRock 
Institutional Trust Company, N.A. Although the London examiners 
do not perform dedicated ongoing supervision, according to OCC 
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officials, they discuss topics with London bank personnel to 
support on-site supervision performed in the U.S. OCC officials told 
us that the London examiners could potentially be used more 
efficiently and that OCC is looking at ways to assess its global 
footprint. 



Recommendations 

We recommend that the Comptroller of the Currency take the 
following actions: 

1 . Ensure that examiners review bank reports and obtain 
satisfactory explanations when those reports show 
significant signs of increasing risk in trading activities. 

Management Response 

Two objectives of the ongoing monitoring procedures 
(included in the supplemental procedures issued on March 
24, 2014) focus on identifying new or changing risks related 
to trading and end-user activity. Examiners are required to 
review on a regular basis reports of the bank's trading 
operations. The procedures for large complex trading 
operations instruct examiners that daily review of profit and 
loss and limit breaches will generally be appropriate, 
supplemented by weekly reviews of position limits, limit 
usage, and stress results. 

OIG Comment 

OCC's corrective action is responsive to the recommendation 
to the extent that examiners obtain explanations for 
significant signs of increasing risk revealed by their reviews. 

2. Amend OCC policies and procedures to clarify that 
examiners should follow up on MRAs no later than during 
the next supervisory cycle, or sooner as dictated by the 
urgency of the examination finding. 
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Management Response 



OCC stated that while it does have guidance in place that 
addresses follow-up on MRAs, the guidance does not set 
time parameters. Two steps in the supplemental procedures 
issued by OCC address this. Examiners are required to assign 
a date by which a MRA must be resolved and they must 
ascertain the status of the MRA on a quarterly basis. If a 
bank fails to resolve the MRA by the due date, and does not 
have adequate justification for that failure, examiners are 
instructed to reflect that failure in their core assessments 
and the management component of the CAMELS rating 12 
and to consider whether an enforcement action may be 
warranted. 

OIG Response 

OCC's corrective action is responsive to the 
recommendation. 

3. Ensure that examiners follow up on findings or concerns 
with a bank's internal audit office and expand the review of 
the internal audit function, as necessary, to determine 
effectiveness. 

Management Response 

In the context of end-user derivatives and trading activity, 
the second objective of the minimum scope section of the 
supplemental procedures is devoted entirely to 
internal/external audit. It requires examiners to determine the 
appropriateness of the audit function for the bank's end-user 
and trading activities. The last objective of the ongoing 
monitoring section is to determine that the bank addresses 
promptly deficiencies and weaknesses related to end-user 
derivatives and trading activity that internal or external 
auditors have identified. 



12 Auditor's Note: Federal banking agencies use the Uniform Financial Institutions Rating System, or 
"CAMELS," to assign composite and component ratings to financial institutions. An institution's 
composite CAMELS rating integrates ratings from six component areas — capital adequacy, asset quality, 
management, earnings, liquidity, and sensitivity to market risk. The ratings range from 1 to 5 with 
1 being the highest rating and least supervisory concern. 
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OIG Response 



OCC's corrective action is responsive to the 
recommendation. 

4. Improve supervisory coordination with other regulatory 
agencies and consider formalizing any understanding or 
agreement. 

Management Response 

OCC instituted a number of actions to improve supervisory 
coordination with other regulatory agencies, such as making 
interagency coordination a supervisory priority and working 
with FRB and FDIC to coordinate supervisory strategies in 
large bank supervision. In some cases, OCC has entered into 
memoranda of understanding with other agencies to 
formalize the understandings for sharing information and 
coordinating supervision, and OCC will continue to enter into 
such agreements in the future as appropriate. 

OIG Response 

OCC's corrective action is responsive to the 
recommendation. 

5. Ensure that revisions to the handbook for supervision of 
trading activities communicate to examiners all activities 
required to be performed during both ongoing supervision 
and targeted examinations. 

Management Response 

The supplemental procedures include both minimum scope 
procedures for targeted examinations to assess the 
effectiveness and integrity of risk management systems, and 
ongoing monitoring procedures to identify trading activity, 
end-user derivatives, and trends in risk profiles. As part of its 
roll-out of the supplemental procedures, OCC will issue a 
supervisory memo to all examiners that communicates 
expectations about their use. Examiners of large banks will 
be instructed to begin using these procedures immediately. 
Examiners of midsize banks will use the procedures — 
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particularly the procedures related to end-user derivatives — 
as appropriate for the bank's complexity and risk profile. The 
procedures are likely not necessary for examinations of 
community banks. 

OIG Comment 

OCC's corrective action, taken and planned, is responsive to 
the recommendation. OCC will need to record the planned 
completion date for issuing the supervisory memo to 
examiners in the Joint Audit Management Enterprise System 
(JAMES), the Department of the Treasury's audit 
recommendation tracking system. 



* * * * * 



We appreciate the courtesies and cooperation provided to our staff 
during the audit. If you wish to discuss the report, you may 
contact me at (202) 927-0384 or Theresa Cameron, Audit 
Manager, at (202) 927-101 1. Major contributors to this report are 
listed in appendix 3. 



Jeffrey Dye /s/ 
Director, Banking Audits 
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Appendix 1 : Objectives, Scope, and Methodology 



Our objective was to determine and assess the Office of the 
Comptroller of the Currency's (OCC) process of supervising bank 
trading activities, primarily focusing on OCC's supervision of 
trading activities at the JPMorgan Chase Bank, N.A. (JPMC) Chief 
Investment Office (CIO) in London. 

To accomplish these objectives, we performed the following 
activities during audit fieldwork conducted from July 2012 through 
January 2013: 

• interviewed OCC examiners for JPMC; Bank of America, N.A.; 
and HSBC Bank USA, N.A., and other OCC officials and 
personnel to gain an understanding of supervising bank trading 
activities 

• reviewed OCC's supervisory guidance on bank trading activities 

• reviewed OCC's supervisory documentation related to JPMC's 
trading activities 

• reviewed an October 2012 OCC internal report on its 
supervision of the CIO and of the JPMC losses 

• performed research on the Edge Act and Edge entities 

• reviewed the report by the Senate Permanent Subcommittee on 
Investigations titled JPMorgan Chase Whale Trades: A Case 
History of Derivatives Risks and Abuses (Mar. 15, 201 3) 

• reviewed other public information, such as documents from the 
JPMC website, to gain additional information about the trading 
losses that occurred in 2012 

We conducted this performance audit in accordance with generally 
accepted government auditing standards. Those standards require 
that we plan and perform the audit to obtain sufficient, appropriate 
evidence to provide a reasonable basis for our findings and 
conclusions based on our audit objectives. We believe that the 
evidence obtained provides a reasonable basis for our findings and 
conclusions based on our audit objectives. 
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Appendix 2: Management's Response 



Office of the Comptroller of the Currency 

Washington, DC 20219 



March 27, 2014 
Jeffrey Dye 

Director, Banking Audits 
Office of Inspector General 
Department of the Treasury 
Washington, DC 20220 

Subject: Response to Draft Report 

Dear Mr. Dye: 

We have reviewed your draft report titled "OCC Needs to Strengthen Supervision of Trading 
Activities in Light of the JPMorgan Chase Trading Losses." Your objective was to determine 
and assess the Office of the Comptroller of the Currency's (OCC) process of supervising bank 
trading activities, primarily focusing on OCC's supervision of trading activities at the JPMorgan 
Chase (JPMC) Chief Investment Office (CIO) in London. 

You concluded that OCC's supervisory response to the CIO's poor risk management and 
increasing risk in the synthetic credit portfolio was insufficient. You also found that OCC should 
improve coordination of its dual regulatory responsibilities with the Federal Reserve (FRB). 
Lastly, you concluded that the Comptroller 's Handbook lacks comprehensive examiner guidance 
for supervision of trading activities. You make five recommendations to address these issues. 

In response to the events at JPMC, we undertook a two-pronged review of our supervisory 
activities. The first component focused on evaluating the adequacy of current risk controls at the 
bank, informed by their application to the positions at issue. We assessed the quality of 
management and risk management; board oversight; the types and reasonableness of risk 
measurement metrics and limits; the model governance review process; and the quality of work 
by the independent risk management team and internal auditors. We also assessed the adequacy 
of the information and reporting provided to bank management and to the OCC. Effective 
supervision is dependent on the quality of information available to examiners. This review 
resulted in the OCC entering into a consent order with JPMC to correct unsafe and unsound 
practices and violations of law or regulation related to derivatives trading activities conducted on 
behalf of the bank by the CIO. The OCC also assessed a $300,000,000 civil money penalty. 

The second component addresses trading activities more broadly and draws on the lessons 
learned from this episode that could enhance risk management processes at other banks. 
Consistent with our supervisory policy of heightened expectations for large banks, we are 
demanding the banks adhere to the highest risk management standards. We are not limiting our 
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inquiry to the particular transactions at issue. We are assessing the adequacy of risk management 
throughout the bank. If corrective action is warranted, we will pursue appropriate informal or 
formal remedial measures. We are also identifying ways to improve our supervision. 

On March 24, we issued procedures that supplement the Comptroller s Handbook for end-user 
derivatives and trading activities while we work through the steps necessary to incorporate them 
into a revised publication of this. The supplemental examination procedures include scope- 
setting and ongoing monitoring procedures. They address many of your recommendations as 
described below. 

First, you recommend the OCC ensure that examiners review bank reports and obtain 
satisfactory explanations when those reports show significant signs of increasing risk in trading 
activities. Two objectives of the ongoing monitoring procedures focus on identifying new or 
changing risks related to trading and end-user activity. Examiners are required to review on a 
regular basis reports of the bank's trading operations. The procedures for large complex trading 
operations instruct examiners that daily review of profit and loss and limit breaches will 
generally be appropriate, supplemented by weekly reviews of position limits, limit usage and 
stress results. 

Second, you recommend the OCC amend policies and procedures to clarify that examiners 
should follow up on matters requiring attention (MRA) no later than during the next supervisory 
cycle, or sooner as dictated by the urgency of the examination finding. While we do have 
guidance in place that addresses follow-up on MRAs, we agree it does not set time parameters. 
Two steps in the supplemental procedures address this. Examiners are required to assign a date 
by which a MRA must be resolved and they must ascertain the status of the MRA on a quarterly 
basis. If a bank fails to resolve the MRA by the due date, and does not have adequate 
justification for that failure, examiners are instructed to reflect that failure in their core 
assessments and the management component of the CAMELS rating and to consider whether an 
enforcement action may be warranted. 

Third, you recommend the OCC ensure that examiners follow up on findings or concerns with a 
bank's internal audit office and expand the review of the internal audit function, as necessary, to 
determine effectiveness. In the context of end-user derivatives and trading activity, the second 
objective of the minimum scope section of the supplemental procedures is devoted entirely to 
internal/external audit. It requires examiners to determine the appropriateness of the audit 
function for the bank's end-user and trading activities. The last objective of the ongoing 
monitoring section is to determine that the bank addresses promptly deficiencies and weaknesses 
related to end-user derivatives and trading activity that internal or external auditors have 
identified. 

Fourth, you recommend the OCC improve supervisory coordination with other regulatory 
agencies and consider formalizing any understanding or agreement. The OCC has instituted a 
number of actions to improve supervisory coordination with other regulatory agencies, such as 
making interagency coordination a supervisory priority and working with the FRB and the 
Federal Deposit Insurance Corporation (FDIC) to coordinate supervisory strategies in Large 
Bank Supervision. In some cases the OCC has entered into memoranda of understanding with 
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other agencies to formalize the understandings for sharing information and coordinating 
supervision, and we will continue to enter into such agreements in the future as appropriate. 

Lastly, you recommend the OCC ensure that revisions to the handbook for supervision of trading 
activities communicate to examiners all activities required to be performed during both ongoing 
supervision and targeted examinations. The supplemental procedures include both minimum 
scope procedures for targeted exams to assess the effectiveness and integrity of risk management 
systems, and ongoing monitoring procedures to identify trading activity, end-user derivatives, 
and trends in risk profiles. As part of our roll-out of the supplemental procedures, we will issue a 
supervisory memo to all examiners that communicates our expectations about their use. 
Examiners of large banks will be instructed to begin using these procedures immediately. 
Examiners of midsize banks will use the procedures —particularly the procedures related to end- 
user derivatives — as appropriate for the bank's complexity and risk profile. The procedures are 
likely not necessary for examinations of community banks. 

If you need additional information, please contact me or Martin Pfinsgraff, Senior Deputy 
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